Splunk Search

Relating data with time

prettysunshinez
Explorer

Hi,
I would like to view today and yesterday data in the same chart for the required time range.

How can that be done.
Help required!
Thanks!

0 Karma

bowesmana
SplunkTrust
SplunkTrust

You can use the timewrap command to do this, e.g.

index=_internal earliest=-4h
| timechart span=1m count 
| timewrap 1h

and it will generate 4 series, one for each hour on the same chart overlayed on top with the x-axis showing the last hour

0 Karma

to4kawa
Ultra Champion

add |where _time > relative_time(now(), "@d+6h") AND _time < relative_time(now(), "@d+12h")

0 Karma

prettysunshinez
Explorer

@to4kawa I would like to view for any specified Time range.
Time range is not fixed

0 Karma

to4kawa
Ultra Champion

make dashboard and token, so use this logic.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...